v0.8.2

A one-line installer

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/Aivyx-Agent/aivyx-coder/releases/latest/download/aivyx-coder-installer.sh | sh

aivyx-coder now installs like Aivyx PA: one line, a checked download, the binary in ~/.cargo/bin (beside aivyx-pa, if you have it), and that folder added to your PATH. Linux (x86_64) and Apple Silicon Macs.

• Archives are renamed aivyx-coder-<target>.tar.gz (for example aivyx-coder-x86_64-unknown-linux-musl.tar.gz), with the binary at aivyx-coder-<target>/aivyx-coder beside README, LICENSE and LICENSES/. Releases are built by cargo-dist.
• Installed an earlier version into ~/.local/bin? Remove it (rm ~/.local/bin/aivyx-coder) so the new one is the one you run.
• macOS builds with the default features. The Linux sandbox (Landlock + seccomp) now compiles away on other platforms instead of needing a separate build, and CI builds and lints on macOS. On macOS, commands still rely on the approval prompts, the deny list and checkpoints, as before; Linux is unchanged.
• Building from source: the binary package is now aivyx-coder (cargo run -p aivyx-coder).

Release gate (fast tier, Qwen3.8-27B, 3 runs each)

Case	Scores	Median	Minutes	Result
just bug hunt	3, 3, 3 /3	3	5.4	ok
recipe	13, 13, 13 /13	13	11.0	ok

Verdict against v0.8.1: PASS.

Full Changelog: v0.8.1...v0.8.2

v0.8.1

A first-run patch from the 2026-11-12 onboarding audit.

Fixed

• The install command in the README and manual works again. Since v0.6.5 the folder inside each release archive has no version in its name, so the documented mv "aivyx-coder-$V-$T/aivyx-coder" failed with cannot stat. The command now extracts the binary straight into ~/.local/bin by its version-free path, and a test ties the docs to the release workflow so they can't drift apart again.
• pytest-style tests are run with pytest. A project with plain test_*.py files (bare def test_…() with assert) got python3 -m unittest, which ran 0 tests and read as a pass, so a broken edit got through verification. Python test files now get unittest only when they use it, and *_test.py files or a tests/ folder get unittest discover; anything else gets python3 -m pytest (which fails loudly when pytest isn't installed, rather than passing).
• The permission box never cuts off its keys. In an 80-column terminal the key help ended mid-sentence ("always allow once you have seen it a…") and so did the scroll hint. The key line now wraps onto another row when the box is narrow, and the scroll hint uses a short form.

New

• Setup finds Docker Model Runner. aivyx-coder --setup probes localhost:12434/engines/v1 alongside Ollama, Lemonade and port 8080, marks it "running now", and lists its models.

Release gate (fast tier, Qwen3.8-27B, 3 runs each)

Case	Scores	Median	Minutes	Result
just bug hunt	3, 3, 3 /3	3	4.0	ok
recipe	13, 13, 13 /13	13	20.3	ok

Verdict against v0.8.0: PASS.

Full Changelog: v0.8.0...v0.8.1

v0.8.0

Changed defaults and removals (read before upgrading)

• [autonomous] max_iterations defaults to 40 (was 20), so a longer --auto build isn't stopped on iterations with time left; max_duration_secs (one hour) is now the limit a run on defaults usually reaches.
• Removed, never read: tool_calling_mode and mistralrs_constrain_tool_calls. Removed experiment: the four [autonomous] final_review* keys (measured with no effect). A config that still sets any of them loads and warns once per key. --report drops its final_review object and is now report_version 2.
• Renamed, as in Aivyx PA: backend.broker_base_url → [broker] base_url; backend.kvcache_store_path / kvcache_max_bytes → [kvcache] store_path / max_bytes; vision.broker_url → [broker] base_url. The old spellings still work, warn once, and the new key wins when both are set.

Images and 3D

Needs [vision] enabled = true, a running mold serve (tested with mold 0.37) and aivyx-broker.

• The agent sees what it makes. With a model that can take images — a llama-server started with its vision projector (--mmproj), or a [routing] model with both tools and vision — generate_image, upscale_image and generate_3d show the model a small preview (for a mesh, a render from two angles), so it can check its work and try again. Otherwise the result says the image wasn't shown. [vision] show_model_previews = false turns this off.
• generate_3d works: a .glb mesh of one object (about 40,000 faces, untextured, about half a minute), from a reference_image of one whole object on a plain background, or from the prompt alone (an image of the object is made first and kept). Needs a Hunyuan3D model on mold (mold pull hunyuan3d-mini-turbo:fp16, 3.8 GB); its licence is Tencent's Hunyuan 3D 2.0 Community License, which does not apply in the EU, the UK or South Korea.
• upscale_image enlarges an image 4x (up to 1 megapixel in; mold pull real-esrgan-x4plus:fp16).
• generate_image gains mask_image (inpainting: repaint only the white part), count (1–4 variations with consecutive seeds) and strength (how far image-to-image may move from the reference). Image-to-image now keeps the reference's shape, and sizes over the model's limit are scaled down instead of refused.
• Image generation works with mold 0.37, whose API now requires the model, size and steps; its errors are explained (a busy GPU, a wrong key, a model that isn't downloaded).
• Images no longer carry their prompt: mold is asked not to embed it, and any it embeds anyway is removed before saving.

Config packs

• A format 2 pack may name [verification] commands (command, scoped_command, final_checks). pack use shows them and records exactly the set you approve, like MCP servers; they're used only while the pack's commands still match, and never fill a field you set yourself. pack use --yes approves non-interactively. Pack commands run without a shell, so shell syntax and quotes are refused.

Warnings and stability

• Every config key coder doesn't read gets one warning at start, with its full path and a "did you mean" hint, on stderr and in aivyx.log.
• An unreadable session file is kept and named instead of silently replaced.
• docs/COMPATIBILITY.md describes what the 1.0 stability promise will cover.

Security

• Model traffic never goes through a proxy. With HTTP_PROXY or ALL_PROXY set, requests to the local model server (prompts and code) used to go to the proxy too; every model-server client now connects directly. [vision] mold_url on another machine gets a warning, as [backend] does.
• rmcp 3.9 (RUSTSEC-2026-0457, -0462; coder only uses its stdio server, which wasn't affected) and SQLite 3.54.1 via aivyx-kvcache (RUSTSEC-2026-0459).

Release gate (fast tier, Qwen3.8-27B, 3 runs each)

Case	Scores	Median	Minutes	Result
just bug hunt	3, 3, 3 /3	3	2.4	ok
recipe	13, 13, 13 /13	13	9.0	ok

Verdict against v0.7.0: PASS.

Full Changelog: v0.7.0...v0.8.0

v0.7.0

Changed defaults (read before upgrading)

• Approval keys: y allow, n deny (Enter and Esc deny too, and the prompt says so), a shows the whole command or diff, and A (Shift+a) is Always Allow. A lowercase a never grants anything any more.
• --setup writes a minimal config: only your [backend] choices plus a short header; everything else follows the built-in defaults, so later default changes reach you. An existing config.toml keeps working as it is. If yours was written by an earlier --setup, it pins every default of that version; you can delete the sections you never changed (for example [permissions] deny_paths or [verification]) to pick up new defaults.
• --auto sends failing final checks back to the model. When [verification] final_checks (a type check, a build, a linter) fail after the goal is reached, their output goes back to the model to fix, up to final_check_retries times (default 2), instead of the run ending as "goal achieved" with a broken build. Set final_check_retries = 0 for the old report-only behaviour.

Terminal UI

• An approval prompt can't be answered by accident. It waits until the keyboard has been quiet for a moment, so a y typed for your next message no longer allows an action; what you typed stays in the message box.
• Pasting works: a paste (bracketed paste) lands in the message box as one block — it is not sent line by line and never reaches an approval prompt. The box grows to six lines; Alt+Enter (or Shift+Enter, where the terminal tells them apart) adds a line.
• Scrolling: PgUp/PgDn, and ↑/↓ or the mouse wheel while the message is one line, scroll the conversation; new output doesn't move what you're reading; Esc returns to the end. Text selection with the mouse still works.
• Commands: Tab completes a /command; Enter on the start of one command completes it; a word that looks like a command but isn't stays in the box with a note instead of going to the model.
• Messages sent during a reply are queued (shown under the reply as queued >), sent in order; Esc takes the last one back, Ctrl+C puts them back in the box.
• d denies and says why: type a short note; the model gets it with the denial.
• On quitting, coder prints how to continue (aivyx-coder --resume) and the files its file tools changed.
• Quieter, clearer screens: reasoning folds to one line (Ctrl+T shows it); the approval box fits its text and keeps diff colours; tool results show project paths relative to the project; /help wraps under each entry and marks commands that need setup (including /models and /model when routing is off); the status line names the model.

Help and first run

• -h is one plain line per flag; --help has the detail, without internal names.
• The welcome screen no longer shows config syntax for the test command.

Bench

The final-checks change was measured over a full-tier run plus the three-case quality set (3 runs each) against v0.6.5 on Qwen3.8-27B: neutral wherever final checks are configured (every score equal), and the retry did not need to fire. It is on by default because it prevents a run from being accepted with its own build failing, not because it raised scores. Three variants of an optional final review pass ([autonomous] final_review) showed no measurable effect and stay off.

Release gate (fast tier, Qwen3.8-27B, 3 runs each)

Case	Scores	Median	Minutes	Result
just bug hunt	3, 3, 3 /3	3	1.7	ok
recipe	13, 13, 13 /13	13	24.2	ok

Verdict against v0.6.5: PASS.

Full Changelog: v0.6.5...v0.7.0

v0.6.5

Security

• Instruction files are checked where they really point. A symlinked AGENTS.md can no longer bring a denied file into the prompt, and the check and the read now use the same open file.
• No writes through symlinks: --report and wiki page stamping refuse a symlink instead of writing through it.
• read_only_paths also covers moving or deleting a parent folder.
• Approval and consent text is complete and neutralised: invisible and bidi characters are shown escaped everywhere approval or pack-consent text appears, and the TUI approval box scrolls instead of clipping (Always Allow only after the whole text was seen).
• A session flagged for prompt injection asks before any network action.
• Fetched pages are bounded: body size is capped while reading, and deeply nested or hostile HTML is converted without recursion, so a page can no longer stall or crash a session.

Editor integration (ACP / Zed)

• Commands, MCP and LSP servers stop when the editor stops coder (even on SIGKILL), and ACP removes its temp folder.
• Files you @-mention in the editor now reach the model (as references it opens with the usual checks); embedded text is capped, neutralised and scanned.
• initialize negotiates the protocol version and sends agent info; unknown session and mode ids are rejected; permission requests use the editor's tool-call id; editor-supplied MCP servers get a notice; "Always Deny" is no longer offered.
• Release archives now unpack to a version-free folder (aivyx-coder-<platform>/aivyx-coder), so registry updates keep working.

Other fixes

• Headless --auto removes its private temp folder on every exit; the user-level and pack AGENTS.md load again on default installs; ACP cancel answers a pending permission request; clearer verification wording.

Release gate (fast tier, Qwen3.8-27B, 3 runs each)

Case	Scores	Median	Minutes	Result
just bug hunt	3, 3, 3 /3	3	3.3	ok
recipe	13, 12, 13 /13	13	21.1	ok

Verdict against v0.6.4: PASS.

Full Changelog: v0.6.4...v0.6.5

v0.6.4

Security

• A repository's own git settings can no longer steer the checkpoint git. The checkpoint git runs outside the sandbox on a repository the sandboxed agent can write. Settings planted there could make it run a program, snapshot files from outside the working folder, or pick a planted checkpoint when rolling back. The checkpoint git now works only on its own folder with fixed settings, accepts a repository's config only from an allow-list, refuses symlinks in its own git folders, and restores only checkpoints it took itself (aivyx-checkpoint a41da40). Upgrade recommended.
• The prompt-injection scan ignores invisible Unicode tag characters and variation selectors that could hide a known injection phrase (aivyx-injection-guard a506c9c).
• Dependency updates for RustSec advisories (rustls, rustls-webpki, root certificates, tokio).

Changed

• When a repository's checkpoints are refused, the session starts with one warning naming the setting; /undo, /redo and rollback are off there, and --auto refuses to run.
• CI checks dependency advisories with cargo-deny and runs weekly.

Release gate (fast tier, Qwen3.8-27B, 3 runs each)

Case	Scores	Median	Minutes	Result
just bug hunt	3, 3, 3 /3	3	7.8	ok
recipe	13, 13, 13 /13	13	33.3	ok

Verdict against v0.6.3: PASS.

Full Changelog: v0.6.3...v0.6.4

v0.6.3

Full Changelog: v0.6.2...v0.6.3

v0.6.2

Full Changelog: v0.6.1...v0.6.2

v0.6.1

Full Changelog: v0.6.0...v0.6.1

v0.6.0

Full Changelog: v0.5.19...v0.6.0